{
  "_id": "userCanReadInventory",
  "description": "Users can read the inventory collection",
  "roles": ["user"],
  "predicate": "path('/inventory') and method(GET)",
  "priority": 100
}

- _id: userCanReadInventory
  description: Users can read the inventory collection
  roles: [ user ]
  predicate: path('/inventory') and method(GET)
  priority: 100

method(GET) and path-prefix('/api')
(method(GET) or method(POST)) and path('/users')
path-prefix('/admin') and not method(DELETE)

{
  "mongo": {
    "allowManagementRequests": false,
    "allowBulkPatch": false,
    "allowBulkDelete": false,
    "allowWriteMode": false,
    "readFilter": {"status": "public"},
    "writeFilter": {"author": "@user._id"},
    "mergeRequest": {"author": "@user._id", "createdAt": "@now"},
    "projectResponse": {"password": 0, "secret": 0}
  }
}

{
  "_id": "userCanGetOwnCollection",
  "description": "Users can read their own collection with pagination",
  "roles": ["user"],
  "predicate": "method(GET) and path-template('/{userid}') and equals(@user._id, ${userid}) and qparams-contain(page) and qparams-blacklist(filter, sort)",
  "priority": 100,
  "mongo": {
    "readFilter": {
      "$or": [
        {"status": "public"},
        {"author": "@user._id"}
      ]
    },
    "projectResponse": {"log": 0}
  }
}

{
  "_id": "userCanCreateDocumentsInOwnCollection",
  "description": "Users can create documents in their collection",
  "roles": ["user"],
  "predicate": "method(POST) and path-template('/{userid}') and equals(@user._id, ${userid})",
  "priority": 100,
  "mongo": {
    "mergeRequest": {
      "author": "@user._id",
      "status": "draft",
      "createdAt": "@now"
    }
  }
}

{
  "_id": "userCanUpdateOwnDocuments",
  "description": "Users can update their own documents",
  "roles": ["user"],
  "predicate": "method(PATCH) and path-template('/{userid}/*') and equals(@user._id, ${userid})",
  "priority": 100,
  "mongo": {
    "writeFilter": {"author": "@user._id"},
    "mergeRequest": {
      "modifiedAt": "@now",
      "modifiedBy": "@user._id"
    }
  }
}

{
  "_id": "adminCanDoEverything",
  "description": ["Admin role can do everything"],
  "roles": ["admin"],
  "predicate": "path-prefix('/')",
  "priority": 0,
  "mongo": {
    "allowManagementRequests": true,
    "allowBulkPatch": true,
    "allowBulkDelete": true,
    "allowWriteMode": true
  }
}

{
  "_id": "publicCanReadProducts",
  "description": "Unauthenticated users can read public products",
  "roles": ["$unauthenticated"],
  "predicate": "method(GET) and path('/products')",
  "priority": 100,
  "mongo": {
    "readFilter": {"published": true, "visibility": "public"},
    "projectResponse": {"internalNotes": 0, "cost": 0}
  }
}

- _id: jwtTenantAccess
  roles: [ jwt-user ]
  predicate: >
    path-template('/{tenant}/data')
    and in(value=${tenant}, array=@user.tenants)
  priority: 100
  mongo:
    readFilter: >
      {"tenantId": "${tenant}"}
    mergeRequest: >
      {"tenantId": "${tenant}", "userId": "@user.sub"}

mongoAclAuthorizer:
  acl-db: restheart
  acl-collection: acl
  # Users with root-role bypass all ACL checks
  root-role: admin
  cache-enabled: true
  cache-size: 1000
  cache-ttl: 5000
  cache-expire-policy: AFTER_WRITE

fileAclAuthorizer:
  # Path to ACL configuration file (absolute or relative to restheart config)
  conf-file: ./acl.yml
  # Or define permissions inline:
  permissions:
    - role: admin
      predicate: path-prefix('/')
      priority: 0

{
  "_id": "userCanReadOwnPosts",
  "description": "Users with 'user' role can read posts they authored or public posts",
  ...
}

[
  {
    "_id": "blockSensitiveEndpoint",
    "roles": ["user"],
    "predicate": "path('/admin/secrets')",
    "priority": 1000,
    "mongo": null
  },
  {
    "_id": "allowGeneralAccess",
    "roles": ["user"],
    "predicate": "path-prefix('/admin')",
    "priority": 100
  }
]

{
  "mongo": {
    "writeFilter": {"author": "@user._id"},
    "mergeRequest": {"author": "@user._id"}
  }
}

{
  "mongo": {
    "projectResponse": {
      "password": 0,
      "ssn": 0,
      "creditCard": 0
    }
  }
}

bson-request-whitelist(name, email, age)  // Only these fields allowed

path-template('/{userid}/documents') and equals(@user._id, ${userid})

{
  "_id": "userCRUDOwnResources",
  "roles": ["user"],
  "predicate": "path-template('/{userid}/*') and equals(@user._id, ${userid})",
  "priority": 100,
  "mongo": {
    "writeFilter": {"author": "@user._id"},
    "readFilter": {"author": "@user._id"},
    "mergeRequest": {"author": "@user._id"}
  }
}

[
  {
    "_id": "publicCanRead",
    "roles": ["$unauthenticated"],
    "predicate": "method(GET) and path-prefix('/posts')",
    "priority": 100,
    "mongo": {
      "readFilter": {"status": "published"}
    }
  },
  {
    "_id": "userCanWrite",
    "roles": ["user"],
    "predicate": "(method(POST) or method(PATCH)) and path-prefix('/posts')",
    "priority": 100,
    "mongo": {
      "mergeRequest": {"author": "@user._id"}
    }
  }
]

- _id: tenantDataAccess
  roles: [ tenant-user ]
  predicate: >
    path-template('/{tenantId}/data')
    and in(value=${tenantId}, array=@user.tenants)
  priority: 100
  mongo:
    readFilter: >
      {"tenantId": "${tenantId}"}
    writeFilter: >
      {"tenantId": "${tenantId}"}
    mergeRequest: >
      {"tenantId": "${tenantId}"}

{
  "_id": "timeLimitedAccess",
  "roles": ["premium"],
  "predicate": "path-prefix('/premium-content')",
  "priority": 100,
  "mongo": {
    "readFilter": {
      "$or": [
        {"expiresAt": {"$gt": "@now"}},
        {"expiresAt": {"$exists": false}}
      ]
    }
  }
}